Both the "initiated" and "completed" notifications in certificate-transfer.service.ts:104-109,216-221 are created for initiatorId/approverId, and the initiation notification embeds the secret confirmationCode. The new owner (toEmail) is never notified and never receives the code, so the intended flow (new owner confirms with the code) is impossible — effectively the initiator both starts and approves the transfer. Fix: send the confirmation-code notification/email to toEmail, and notify the recipient on completion.
Both the "initiated" and "completed" notifications in
certificate-transfer.service.ts:104-109,216-221are created forinitiatorId/approverId, and the initiation notification embeds the secretconfirmationCode. The new owner (toEmail) is never notified and never receives the code, so the intended flow (new owner confirms with the code) is impossible — effectively the initiator both starts and approves the transfer. Fix: send the confirmation-code notification/email totoEmail, and notify the recipient on completion.